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IN THE UNITED STATES DISTMCT COURT 
FOR THE DISTRICT OF COLUMBIA 



WILLIAM A. MORGAN, JR., P.C, 

Plaintiff, 



SUSAN WISWELL, 
ANGELA MURPHY, 
JOHN DOES(S) 1-10, 

Defendants. 



CIVIL ACTION NO. 



PLAINTIFF'S MEMORANDUM IN SUPPORT OF ITS 
MOTION TO PRESERVE EVIDENCE AND FOR EXPEDITED DISCOVERY 

I. Plaintiff Needs a Preservation Order and Expedited Discovery 

Plaintiff William A. Morgan, Jr., PC ("Plaintiff) respectfully moves this Court for an 

order to preserve evidence and granting expedited discovery, as set forth in more detail below. 

Plaintiff files concurrently with this motion a Complaint alleging violation of the 
Computer Fraud and Abuse Act and the Electronic Communication and Privacy Act, among 
other claims, and a Motion for Temporary Restraining Order to prevent Defendants from 

continuing to access or attempting to access Plaintiffs computer system without authorization, 
intercepting and/or attempting to intercept Plaintiffs email, and possessing, using, disclosing, or 
acting upon Plaintiffs email or other proprietary electronic information. A preservation order is 
necessary to prevent Defendants' destruction or attempts to destroy evidence supporting 
Plaintiffs claims. Expedited discovery is needed to allow Plaintiff to gather evidence to 
supplement its motion and for the preliminary injunction hearing that will eventually follow. 
Plaintiff respectfully submits that it is critical that discovery is conducted prior to the 
prehminary injunction hearing to determine the full extent of Defendants' unlawful activities, 
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and thus establish the scope of Plaintiff s right to preliminary injunctive relief in this action. 
Plaintiff has been irreparably harmed by Defendants' actions. As shown in Plaintiffs Motion for 
Temporary Restraining Order, Plaintiff is likely to succeed on its claims against Defendants. 
The expedited discovery sought by this motion will further prove Defendants' unlawful access or 
attempted access, copying, transmission, interception, and use of Plaintiff s proprietary and 
confidential communications and other information, and will serve to mitigate any further 
damage to Plaintiff Without expedited discovery, it is also likely that evidence of Defendants' 
unlawful activities, which is highly likely to be found on Defendants' computers, will be 
destroyed. For these reasons, Plaintiff is entitled to expedited discovery in this matter. See In re 
Fannie Mae Derivative Litigation, 227 F.R.D. 142, 142-43 (D.D.C. 2005) (describing the two 
standards the court applies in granting expedited discovery). 

It is well recognized that courts have the power to order expedited discovery where a 
party has moved for preliminary injunction or where there is imminent danger of irreparable 
harm to the party if discovery does not move forward immediately. Fed. R. Civ. P. 33(a), 34(b); 
see In re Fannie Mae Derivative Litigation, 227 F.R.D. at 143 (noting that evidence of 
irreparable harm or a pending preliminary injunction are among the factors to be considered by 
the court for expedited discovery requests); Ellsworth Assoc, Inc. v. United States of Am., 917 F. 
Supp. 841, 844 (D.D.C. 1996) ("Expedited discovery is particularly appropriate when a plaintiff 
seeks injunctive relief because of the expedited nature of injunctive proceedings."). 
II. Direct Discovery of Defendants is Needed 

Plaintiff therefore requests that pursuant to Fed. R. Civ. P. 34(a) Defendants Murphy and 
Wiswell be ordered to permit Plaintiffs computer forensic expert to inspect and make mirror 
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images' of Defendants' and Defendant WiswelFs husband's computer hard drives, other 
computer memory devices, and server transaction histories within twenty-four (24) hours of any 
order granting this motion, and to respond fully and completely to the following production 
requests within three (3) days of any order granting this motion: 

Piscovery Requests : 

1 . Plaintiffs computer forensics expert shall be permitted to 
inspect and make an electronic image of Susan WiswelFs 
entire personal computer hard drive(s) or other computer 
memory devices controlled and used by Susan Wiswell 
from May 1, 2005 to the present. 

2. Plaintiffs computer forensics expert shall be permitted to 
inspect and make an electronic image of Angela Murphy's 
entire personal computer hard drive(s) or other computer 
memory devices controlled and used by Angela Murphy 
from May 1, 2005 to the present. 

3. Plaintiffs computer forensics expert shall be permitted to 
inspect and make an electronic image of Donald WiswelFs 
entire personal computer hard drive(s) or other computer 

memory devices controlled and used by Donald Wiswell 
from May 1, 2005 to the present. 

4. Plaintiffs computer forensics expert shall be permitted to 
inspect and make electronic images of the server 
transaction history for Susan WiswelFs personal computer 
system(s) from May 1, 2005 to the present. 

5. Plaintiffs computer forensics expert shall be permitted to 
inspect and make electronic images of the server 
transaction history for Angela Murphy's personal computer 
system(s) from May 1, 2005 to the present. 

6. Plaintiffs computer forensics expert shall be permitted to 
inspect and make electronic images of the server 



' "A 'mirror image' is a copy of a hard drive, created by either installing a second hard drive on the computer and 
running a disk cloning program, or by removing the hard drive from the computer temporarily and cloning it on 
another computer. This gives a data recovery expert more time to analyze the data and to minimize the amount of 
time that the computer is placed out of commission, as well as to avoid damage or modification of the original disk." 
Adam I. Cohen & David J. Lender, Electronic Discovery: Law and Practice § 10.02[A], at 10-5 n. 17 (Supp. 2005). 
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transaction history for Donald Wiswell's personal computer 
system(s) from May 1, 2005 to the present. 

7. Plaintiffs computer forensics expert shall be permitted to 
inspect and make an electronic image of the entire email 
account, including but not limited to the Inbox, Sent files, 
and folders associated with the email address 
iohniohnson 1974(Sivahoo.com . 

8. Plaintiffs computer forensics expert shall be permitted to 
inspect and make an electronic image of the entire email 
account, including but not limited to the Inbox, Sent files, 
and folders associated with the email address 
notmuchman 01@vahoo.com . 

9. Copies of all of Plaintiff s ingoing and outgoing emails 
intercepted by Susan Wiswell. 

1 0. Copies of all of Plaintiff s ingoing and outgoing emails 
intercepted by Angela Murphy. 

1 1 . Copies of all of Plaintiffs ingoing and outgoing emails 
intercepted by or forwarded to 

iohniohnson 1974(g)vahoo.com . 

1 2 . Copies of all of Plaintiff s ingoing and outgoing emails 
intercepted by or forwarded to 

notmuchman 01(a),vahoo.com . 

1 3 . Copies of all documents and things authored or created by 
or for Plaintiff or Plaintiffs clients in Angela Murphy's 
possession, custody, or control. 

1 4. Copies of all documents and things authored or created by 
or for Plaintiff or Plaintiffs clients in Susan Wiswell's 
possession, custody, or control. 

1 5 . Copies of all documents and things, including email, sent to 
any of Plaintiff s clients without Plaintiffs authorization by 
Susan Wiswell from May 1, 2005 to the present. 

1 6. Copies of all documents and things, including email, sent to 
any of Plaintiff s chents without Plaintiffs authorization by 
Angela Murphy from May 1, 2005 to the present. 
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17. Copies of all documents and things authored or created by 
or for Plaintiff or Plaintiffs clients and provided to 
Hildebrand, Limparis & Associates, CPA's, PC, or 
downloaded, placed or stored on Hildebrand, Limparis & 
Associates, CPA's, PC's email or computer systems by 
Susan Wiswell from June 1, 2005 to the present. 

1 8. Copies of all documents and things authored or created by 
Susan Wiswell and provided to Plaintiff, including but not 
limited to fake resumes, from June 1, 2005 to the present. 

19. Copies of all documents and things authored or created by 
Angela Murphy and provided to Plaintiff, including but not 
limited to fake resumes, from June 1, 2005 to the present. 

20. Copies of all documents and things referring or relating to 
Tara Benedict. 

2 1 . Copies of all documents and things referring or relating to 
Dave Waskiewicz. 

22. Copies of all documents and things referring or relating to 
Kendra Fellows. 

23. Copies of all written communications and documents, 
including email, between any of Susan Wiswell, Angela 
Murphy, Donald Wiswell, and/or any John Doe relating to 
Plaintiff, Plaintiffs chents, the creation of fake resumes, 
the interception, copying, or transmission of Plaintiff s 
electronic communications and/or documents, and 
successful and unsuccessful attempts to log on to Plaintiffs 
email and/or other computer systems, from May 1, 2005 to 
the present. 

The definitions used in the above discovery are the same as those set forth in the 
Complaint and Motion for Temporary Restraining Order. The term 'interception' includes all 
incoming and outgoing communications and documents routed from or to Plaintiffs computer 
servers and/or email accounts by Defendants. 

These discovery requests are clear, concise, and narrowly tailored to provide specific 
information needed for the preliminary injunction motion. The discovery of all information 
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contained on Defendants' computer hard drives and email accounts is relevant in this case 
because Plaintiffs electronic communications, and potentially other electronic information, such 
as client fdes, were intercepted by and routed to Defendants through several different email 
accounts. "It is black letter law that computerized data is discoverable if relevant." Anti- 
Monopoly, Inc. V. Hasbro, Inc., 94 Civ. 2121, 1995 U.S. Dist. 16355, *4 (S.D.N.Y. Nov. 3, 
1995). This is particularly true in cases such as this, where the allegedly unlawful activities, 
such as the improper interception of and access to electronic communications and documents, 
took place on a computer. See LEXIS-NEXIS v. Beer, 41 F. Supp. 2d 950, 953 (D. Minn. 1999) 
(expedited discovery ordered to make mirror image copy of computer hard drive in trade secrets 

case). 

After Plaintiff obtains the hard drive mirror images and other documents sought by this 

motion, Plaintiff wishes to depose Defendants on an expedited basis. 

To ensure the integrity of the mirror images. Plaintiff asks this Court to allow Plaintiffs 
expert to inspect and make the electronic image of Defendants' computers and memory devices. 
Plaintiffs expert will not only image the hard drives and memory devices, but should also be 
able to recover relevant deleted emails and documents. By allowing Plaintiffs expert to conduct 
the imaging of Defendants' computers and memory devices the Court will save the parties, and 
this Court, time and money in determining whether or not all files were captured during the 
initial imaging. In Simon Prop. Group LP. v. mySimon, Inc., 194 F.R.D. 639, 640 (S.D. Ind. 
2000), the plaintiff moved to compel four of the defendant's employees to make home and work 
computers, computer servers, and electronic recording devices available for inspection for the 
purpose of recovering deleted files. The court first found that "computer records, including 
records that have been 'deleted,' are documents discoverable under Fed. R. Civ. P. 34." Id. The 



Case 1:05-cv-01 561 -JR Document 4-2 Filed 08/03/2005 Page 7 of 10 

court granted the plaintiffs' request and allowed the plaintiff to select an expert (which the court 
then appointed as its own expert) to make a "mirror image" of the hard drives and undertake the 
task (at Plaintiffs expense) of attempting to recover the deleted files. Id. at 641. 

Similarly, in Antioch Co. v. Scrapbook Borders, Inc., 210 F.R.D. 645, 650-51 (D. Minn. 
2002), a copyright infringement case, the plaintiff moved to compel the production of computer 
equipment so that a court-appointed computer forensics expert could recover deleted data. 
Attempting to compel immediate discovery, the plaintiff presented a computer forensics expert's 
affidavit in support of the theory that deleted data is retained on a hard drive, but constantly 
overwritten by new data. Finding that "the Defendants may have relevant information" on their 
computer that could be lost through normal usage, the court concluded that "Antioch should be 
able to attempt to resurrect data which has been deleted from the Defendants' computer 
equipment, and therefore, we grant its Motion to Compel." Id. at 652. 

Finally, in Northwest Airlines, Inc. v. Local 2000, IntlBhd. of Teamsters, 2000 U.S. 
Dist. LEXIS 22638, Civ. No. 00-08 (D. Minn. Feb. 2, 2000), the court appointed Plaintiffs 
expert as its own neutral information collector and ordered all of the named defendants (i.e., the 
union, more than twelve union officials, and two employees) to allow the expert to create mirror 
images of the hard drives of their office and home computers. 

III. Discovery of Defendant WiswelFs Work Computer is Also Needed 

Plaintiff also asks this Court to issue a subpoena granting Plaintiff s computer experts the 
right to inspect and make mirror images of Defendant Wiswell's hard drive and server logs at 
Defendant Wiswell's current place of employment. 



2 Plaintiff is not requesting access to Defendant Murphy's employer's computer system and 
server at this time. Plaintiff may ask this Court for a subpoena of Defendant Murphy's 
employer's computer system at a later time. 
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Plaintiff has discovered that Defendant Wiswell has attempted to access Plaintiffs 
system from both her work and home computers. In addition, Defendant Wiswell has sent bogus 
resumes to Plaintiff from both her work and home computers. Attached as Exhibit 1 is a copy of 
an email sent from Defendant Wiswell to Plaintiff requesting reconciliation of some travel 
expenses. The IP address of the computer from which the email was sent is 67.20.56.211. 
Attached as Exhibit 2 is a copy of an email sent from one of the fake job applicants, Tara 
Benedict. The IP address of the computer from which the email was sent is also 67.20.56.21 1 . 
The IP address 67.20.56.21 1 is owned by Internet Service Provider Adelphia Cable 
Communications and connected to Wiswell' s home computer. {See Ver. Compl. f 40— Ex. A, 
Rosenbaum Deck, ff 16(b), 17, 20.) 

Similarly, attached as Exhibit 3 is a copy of another email sent from the same fake job 
applicant, Tara Benedict. The IP address of the computer from which the email was sent is 
209.166.2.130. Attached as Exhibit 4 is a copy of an email sent from Defendant Wiswell to 
Plaintiff on June 27, 2005. The IP address of the computer from which the email was sent is also 
209.166.2.130. Attached as Exhibit 5 is a Msting of the company that uses the 209.166.2.130 IP 
address— Hildebrand, Limparis & Associate, CPAs, PC ("Hildebrand"). Attached as Exhibit 6 is 
a copy of Defendant Wiswell' s biography as a CPA employed by Hildebrand. Finally, attached 
as Exhibit 7 is a copy of Plaintiff s Server Log showing that both IP addresses noted above are IP 
addresses used by the person who has and continues to attempt to gain access to Plaintiffs 
server. Plaintiff therefore also asks this Court to issue a subpoena permitting Plaintiffs 
computer forensics expert to inspect and make images of the hard drives used by Defendant 
Wiswell for email and storage of electronic documents at Hildebrand, as well as all server logs 
for such hard drives, and to recover any relevant deleted emails and documents. 
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As noted above, Plaintiff has a good faith basis for requesting images of the hard drives 
used by Defendant for email and storage of electronic documents at Hildebrand, and all server 
logs for such hard drives. Plaintiff has clear evidence that Defendant Wiswell has used both her 
home and work computers and servers for her unlawful access to and interception of Plaintiff s 
electronic communications. Plaintiff recognizes the sensitivity involved in obtaining access to 
Hildebrand' s hard drives and server logs. As a result, Plaintiff attaches as Exhibit 8 a Protective 
Order that classifies all of Hildebrand' s data as confidential and for attorneys' eyes only and 
setting forth the process Plaintiff must go through if a particular Hildebrand document needs to 
be revealed to Plaintiff Assuming that this Court grants this motion. Plaintiff will contact 
Hildebrand and attempt to obtain its cooperation in obtaining images of the hard drives used by 
Defendant Wiswell for email and for storing electronic documents at Hildebrand, and all server 

logs for such hard drives. 

Because of the expedited nature of this case, and the continuing irreparable harm to 
Plaintiff caused by Defendants' conduct, as detailed in Plaintiffs Motion for Temporary 
Restraining Order, Plaintiff respectfully requests that this Court order the expedited discovery 
requested above. 
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Dated: August 2, 2005 



Respectfully submitted. 





/Homick, £sc|. (D.C. Bar No. 384701) 
^,- H. King, Esq. (D.C. Bar No. 473007) 
lothy A. Lemper, Esq. (admission pending) 
FINNEGAN, HENDERSON, FARABOW, 

GARRETT & DUNNER, L.L.P. 
901 New York Ave., N.W. 
Washington, D.C. 20001-4413 
(202) 408-4000 
Attorneys for Plaintiff 
William A. Morgan, Jr., P.C. 
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